Skip to content

Commit d4ed653

Browse files
evanpjensenevanpjensen
committed
:(
1 parent ea53d52 commit d4ed653

4 files changed

Lines changed: 27 additions & 20 deletions

File tree

‎lib_research/gs.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ void* getStringIndex(void);
1010
void* getgotzero(void);
1111
void* getgotone(void);
1212
void* getgottwo(void);
13+
void* findelfheader(void);
1314
void patchmygot(void);//noreturn
1415
void patchmygotpie(void);//noreturn
1516
void fixdynamicpie(void);

‎lib_research/gs.s‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,15 @@
1919
global patchmygot
2020
global patchmygotpie
2121
global fixdynamicpie
22+
global findelfheader
2223
2324
extern _DYNAMIC
2425
extern _GLOBAL_OFFSET_TABLE_
2526
2627
%define EI_NIDENT 16
2728
%define DYNAMICPTRS 0x6a230f8
29+
%define ELFHEADER 0x464c457f
30+
2831
;; http://www.sco.com/developers/gabi/latest/ch5.dynamic.html
2932
;; hex(sum(map(lambda b:1<<b,[3,4,5,6,7,12,13,17,21,23,25,26])))
3033
@@ -178,7 +181,7 @@ fixdynamicpie:
178181
ja fixdynamicpie.test ;if value of d_un>31 look at the next one
179182
;; what follows is one of my favorite compiler tricks
180183
mov edx,1
181-
shl edx,ecx
184+
shl edx,cl
182185
and edx,DYNAMICPTRS
183186
;;https://isisblogs.poly.edu/2013/05/06/oh-compiler-you-so-crazy/
184187
jz .test
@@ -190,4 +193,14 @@ fixdynamicpie:
190193
pop esi
191194
pop ebp
192195
ret
193-
196+
197+
findelfheader:
198+
call getCode
199+
.test:
200+
mov ecx,[eax]
201+
cmp ecx,ELFHEADER
202+
jz findelfheader.fin
203+
dec eax
204+
jmp findelfheader.test
205+
.fin:
206+
ret

‎lib_research/lib.c‎

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
#include "gs.h"
33

44

5+
#define BREAK() __asm__("int3")
6+
57
#ifdef LIB
68
extern void _start(void){
79
main();
@@ -12,27 +14,14 @@ extern void print_hello(void){
1214
puts("hello");
1315
return;
1416
}
15-
/*
16-
extern int main(){
17-
static char* s="\xcc\xc3";
18-
//((void (*)(void))s)();
19-
return 0;
20-
}
21-
*/
2217

23-
void brake(void){
24-
const char* b="\xcc\xc3";
25-
((void (*)(void))b)();
26-
return;
27-
}
2818

29-
30-
extern int main(int arc,char** argv){
31-
19+
extern int main(int arc,char** argv){
3220
printf("TLS : %p\n",getTLS());
3321
printf("libc : %p\n",getLibc());
3422
printf("code : %p\n",getCode());
3523
printf("strings: %p\n",getStringIndex());
24+
printf("ELF header: %p\n",findelfheader());
3625
printf("gotzero: %p\n",getgotzero());
3726
printf("gotone: %p\n",getgotone());
3827
printf("gottwo: %p\n",getgottwo());
@@ -46,8 +35,8 @@ extern int main(int arc,char** argv){
4635
printf("base : %p\n",gettextload());
4736
}
4837

49-
50-
brake();
38+
BREAK();
39+
5140

5241
return 0;
5342
}

‎lib_research/stage/s.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44
#include <string.h>
55
#include <sys/mman.h>
66

7+
extern _GLOBAL_OFFSET_TABLE_;
8+
79
#define BREAK() __asm__("int3");
810
//extern _GLOBAL_OFFSET_TABLE_
911

@@ -16,13 +18,15 @@ void _start(void){
1618

1719
int main(int argc,char** argv){
1820
#ifdef DEBUG
21+
mprotect((void*)(_GLOBAL_OFFSET_TABLE_&(~0xfff)), 0x1000, PROT_EXEC|PROT_READ|PROT_WRITE);
1922
BREAK();
2023
#endif
2124
char buf[100];
2225
char* message="I'M THE BOSS\n";
2326
//BREAK();
24-
//mprotect(0x8049ff4&(~0xfff), 0x1000, PROT_EXEC|PROT_READ|PROT_WRITE);
27+
2528
patchmygotpie();
29+
fixdynamicpie();
2630
#ifdef DEBUG
2731
BREAK();
2832
#endif

0 commit comments

Comments
 (0)